إدارة الأسرار (Secrets Management)

# .env
DB_PASSWORD=supersecret123
JWT_SECRET=my-jwt-secret
STRIPE_API_KEY=sk_live_xxxxx
SENDGRID_API_KEY=SG.xxxxx

require('dotenv').config();

const dbPassword = process.env.DB_PASSWORD;
const jwtSecret = process.env.JWT_SECRET;

# .env.example (آمن للنشر)
DB_PASSWORD=
JWT_SECRET=
STRIPE_API_KEY=

const vault = require('node-vault')({
  apiVersion: 'v1',
  endpoint: 'https://vault.example.com',
  token: process.env.VAULT_TOKEN,
});

const secrets = await vault.read('secret/data/api');
const dbPassword = secrets.data.data.DB_PASSWORD;

const { SecretsManager } = require('@aws-sdk/client-secrets-manager');

const client = new SecretsManager({ region: 'us-east-1' });
const secret = await client.getSecretValue({ SecretId: 'prod/db/password' });
const dbPassword = JSON.parse(secret.SecretString).password;

name: Deploy
on: [push]
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Deploy
        env:
          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
          API_KEY: ${{ secrets.API_KEY }}
        run: ./deploy.sh

variables:
  - group: Production-Secrets

// استخدام توكنات قصيرة الأمد (STS)
const sts = new AWS.STS();
const tempCredentials = await sts.getSessionToken({
  DurationSeconds: 3600, // صلاحية ساعة
}).promise();

# فحص repository عن أسرار مسربة
npx trufflehog --regex --entropy=False https://github.com/user/repo